From: Dan McDonald <danmcd@omniti.com>
Date: Tue, 24 Jun 2014 02:25:02 +0000 (-0400)
Subject: Illumos #4936 fix potential overflow in lz4
X-Git-Tag: zfs-0.6.4~241
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ee4712284cd6c0532b6fb78e23a3799f4ccdd675;p=zfs

Illumos #4936 fix potential overflow in lz4

4936 lz4 could theoretically overflow a pointer with a certain input
Reviewed by: Saso Kiselkov <skiselkov.ml@gmail.com>
Reviewed by: Keith Wesolowski <keith.wesolowski@joyent.com>
Approved by: Gordon Ross <gordon.ross@nexenta.com>
Ported by: Tim Chase <tim@chase2k.com>

References:
  https://illumos.org/issues/4936
  https://github.com/illumos/illumos-gate/commit/58d0718

Porting notes:

This fixes the widely-reported "20-year-old vulnerability" in
LZO/LZ4 implementations which inherited said bug from the reference
implementation.

Signed-off-by: Richard Yao <ryao@gentoo.org>
Signed-off-by: Tim Chase <tim@chase2k.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #2429
---

diff --git a/module/zfs/lz4.c b/module/zfs/lz4.c
index 497296e35..5c3c6cdb1 100644
--- a/module/zfs/lz4.c
+++ b/module/zfs/lz4.c
@@ -907,6 +907,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize,
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if ((cpy > oend - COPYLENGTH) ||
 		    (ip + length > iend - COPYLENGTH)) {
 			if (cpy > oend)